mattmre/reverse-engineering-company-system
SKILLS/DEVELOPER TOOLS/reverse-engineering-company-system/SKILL.md
Run reverse engineering as a coordinated EVOKORE operating system with expert panels, additive workflows, and lightweight learning loops. Use when the target is complex enough that you want more than isolated tool calls.
$ install --global
skillsauthnpx skillsauth add mattmre/evokore-mcp reverse-engineering-company-systemInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 26, 2026, 12:24 PM55.4s4 files scanned
SKILL.md
- name:
- reverse-engineering-company-system
- description:
- Run reverse engineering as a coordinated EVOKORE operating system with expert panels, additive workflows, and lightweight learning loops. Use when the target is complex enough that you want more than isolated tool calls.
- aliases:
- [re-company, reverse-engineering-operating-model, binary-analysis-company, re-system]
- category:
- Developer Tools
- tags:
- [reverse-engineering, orchestration, ghidra, debugger, decompiler, memory, workflow]
- version:
- 1.0.0
- source:
- evokore
- derived_from:
- [Ghidra, radare2, rizin, Cutter, x64dbg, pwndbg, angr, qiling, JADX, ILSpy, capa, Pharos]
Reverse Engineering Company System
Use this skill when reverse engineering needs to behave like a practiced research organization instead of a sequence of disconnected tool invocations. The goal is additive output: static recon informs semantic recovery, semantic recovery sharpens debugger plans, dynamic evidence hardens capability claims, and every session leaves behind reusable memory.
Core Operating Model
- Intake and segmentation — classify the target and decide whether the main lane is native, .NET, JVM/Android, firmware, or suspicious-sample triage.
- Static recon — imports, exports, strings, entry points, subsystem map, priority function queue.
- Semantic recovery — decompilation, xrefs, renaming, typing, comments, structure recovery, certainty scoring.
- Dynamic hypothesis testing — x64dbg / WinDbg / pwndbg-style flows, Qiling or other emulator help when execution context matters.
- Capability synthesis — threat behavior, ATT&CK framing, persistence / C2 / credential / anti-analysis claims when relevant.
- Learning capture — evidence, unresolved questions, automation candidates, persona/workflow improvements.
EVOKORE-Native Building Blocks
- Panel:
orch-panel reuses the Reverse Engineering Panel for unknown binaries, semantic campaigns, debugger planning, and workflow refinement. - Workflow:
panel-of-experts/workflows/reverse-engineering-analysis.json - Research workflow:
panel-of-experts/workflows/reverse-engineering-repo-research.json - Learning loop:
panel-of-experts/workflows/reverse-engineering-improvement-loop.json
Complementary Skill Stack
Start from the skill that matches the phase:
unknown-binary-onboarding— establish the first analysis charter and choose tool lanes.ghidra-core-recon— map the binary before interpreting it.ghidra-function-analysis— recover subsystem semantics.semantic-recovery-campaign— run naming/type cleanup as a disciplined campaign.debugger-driven-analysis— resolve runtime-only ambiguity.malware-triage-workflow— escalate suspicious behavior into capability-oriented triage.reverse-engineering-improvement-loop— convert session evidence into better future workflows.
Design Rules
- Do not let decompiler output outrun evidence.
- Do not debug without a concrete question.
- Prefer tool specialization early: ILSpy for .NET, JADX/Vineflower for managed/JVM targets, Ghidra for broad native analysis.
- Escalate to automation only when the ambiguity is recurring or expensive enough to justify it.
- Every major conclusion should survive a session handoff without requiring the next run to rediscover it.
Memory and Self-Improvement
Use lightweight memory, not bloated transcripts:
- hypothesis ledger
- evidence ledger
- naming/type ledger
- dynamic validation log
- improvement backlog
Those artifacts should feed EVOKORE's existing continuity surfaces:
session-replayevidence-capturepersistent-narrativesimprovement-cyclessession-wrap
Bundled References
references/operating-model.mdreferences/repo-pattern-matrix.mdreferences/learning-loop.md
Related Skills
mattmre/orchestration-framework
development
VerifiedTrustedCommunity
Core orchestration framework for model-agnostic multi-agent workflows with handoff protocol, policy governance, and configuration schemas
4SKILL.mdUpdated Apr 26, 2026
mattmre/triage-issue-skill
testing
VerifiedTrustedCommunity
Specialized skill for triage issue skill workflows.
4SKILL.mdUpdated Apr 26, 2026
mattmre/hive
development
VerifiedTrustedCommunity
Complete workflow for building, implementing, and testing goal-driven agents. Orchestrates hive-* skills. Use when starting a new agent project, unsure which skill to use, or need end-to-end guidance.
4SKILL.mdUpdated Apr 26, 2026
mattmre/hive-test
development
VerifiedTrustedCommunity
Iterative agent testing with session recovery. Execute, analyze, fix, resume from checkpoints. Use when testing an agent, debugging test failures, or verifying fixes without re-running from scratch.
4SKILL.mdUpdated Apr 26, 2026